From Ground Control to Star Wars: Hacking Satellite Constellations Using Autonomous AI

Modern satellite constellations are commanded, tasked, and monitored through the ground segment, and the ground segment now runs on APIs: tasking, telemetry, ground-station scheduling, and mission operations. Those APIs are scalable, automatable, and increasingly exposed, and they inherit every weakness we have spent a decade documenting in enterprise software. The difference is the blast radius. Here, a broken authorization check is not a leaked record. It is command authority over an asset in orbit.

This session takes the audience from first principles to full compromise. We begin with how ground control systems actually work, where APIs fit into the modern space enterprise, and why the shift from enterprise to orbit has quietly moved the attack surface to the ground. We then walk the vulnerability classes that matter, mapped to the OWASP API Security Top 10, using satellite-flavored examples: broken object level authorization, broken authentication, mass assignment, broken function level authorization, unrestricted access to sensitive business flows, server side request forgery, and the shadow and zombie APIs that operators forget to turn off.

Individually, these flaws look survivable. Chained, they are catastrophic. The core of the talk is the kill chain: how an attacker authorized to a single satellite can escalate, step by step, to command authority over an entire constellation, and what that means for maneuvering, attitude control, payload tasking, and communications on a real spacecraft.

Then we let AI take over. Reaper, executes the chain live and at machine speed against a deliberately vulnerable satellite ground-control API in an isolated lab. On a live three-dimensional visualization of Earth, the audience watches the consequences unfold in real time as satellites tumble, change orbit, and go dark. One theme runs underneath the spectacle: the capability that makes this possible does not live in the model. It lives in the harness. We show how improving the harness, not swapping in a larger model, is what instruments an autonomous system to understand a ground control system and take it apart.

We close where a training audience needs us to: defense. What it takes to protect space and federal infrastructure against offensive AI, from enforcing object and function level authorization and killing shadow APIs, to Zero Trust for the ground segment, to continuous autonomous adversary emulation, because point-in-time testing cannot keep pace with an attacker that never sleeps.

You will leave understanding the real satellite attack surface, why autonomous offense changes the timeline, and what to do about it before someone else does.